From 5b14f839f0aea6f77c3b1a956e61ad70e0d45990 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sergi=20=C3=80lvarez=20i=20Capilla?= <pancake@nowsecure.com>
Date: Thu, 26 May 2016 00:46:39 +0200
Subject: [PATCH] Filter some chars in filenames in JSON mode

---
 backend/devfsev.c |  6 ++++--
 backend/inotify.c |  2 +-
 main.c            | 10 ++++++++--
 util.c            | 21 ++++++++++++++++++++-
 util.h            |  6 +++++-
 5 files changed, 38 insertions(+), 7 deletions(-)

diff --git a/backend/devfsev.c b/backend/devfsev.c
index 0554824..980eb5b 100644
--- a/backend/devfsev.c
+++ b/backend/devfsev.c
@@ -194,13 +194,15 @@ static bool fm_loop (FileMonitor *fm, FileMonitorCallback cb) {
 				ev.type = fme->type;
 				ev.pid = fme->val.u32;
 				ev.ppid = 0;
-				ev.proc = getProcName (ev.pid, &ev.ppid);
+				ev.proc = get_proc_name (ev.pid, &ev.ppid);
 				ev.file = (const char *)buf + buf_idx + sizeof (FMEventStruct);
 			}
 			/* parse data packet */
 			arg_len = parse_event (&ev, fme);
 			if (arg_len == -1) {
-				if (ev.pid && ev.type != -1 && cb) cb (fm, &ev);
+				if (ev.pid && ev.type != -1 && cb) {
+					cb (fm, &ev);
+				}
 				fsevent_free (&ev);
 				arg_len = 2;
 			} else if (arg_len < 1) {
diff --git a/backend/inotify.c b/backend/inotify.c
index cc2f6a1..71f7b3b 100644
--- a/backend/inotify.c
+++ b/backend/inotify.c
@@ -98,7 +98,7 @@ static bool parseFaEvent(FileMonitor *fm, struct fanotify_event_metadata *metada
 
 	ev->file = path;
 	ev->pid = metadata->pid;
-	ev->proc = getProcName (ev->pid, &ev->ppid);
+	ev->proc = get_proc_name (ev->pid, &ev->ppid);
 	if (metadata->mask & FAN_ACCESS) ev->type = FSE_STAT_CHANGED;
 	if (metadata->mask & FAN_OPEN) ev->type = FSE_OPEN;
 	if (metadata->mask & FAN_MODIFY) ev->type = FSE_CONTENT_MODIFIED;
diff --git a/main.c b/main.c
index 891e15b..590ae49 100644
--- a/main.c
+++ b/main.c
@@ -76,10 +76,12 @@ static bool callback(FileMonitor *fm, FileMonitorEvent *ev) {
 			return false;
 	}
 	if (fm->json) {
+		char *filename = fmu_jsonfilter (ev->file);
 		printf ("%s{\"filename\":\"%s\",\"pid\":%d,"
 			"\"uid\":%d,\"gid\":%d,", 
-			firstnode? "":",", ev->file, ev->pid, ev->uid, ev->gid);
+			firstnode? "":",", filename, ev->pid, ev->uid, ev->gid);
 		firstnode = false;
+		free (filename);
 		if (ev->inode) {
 			printf ("\"inode\":%d,", ev->inode);
 		}
@@ -97,10 +99,14 @@ static bool callback(FileMonitor *fm, FileMonitorEvent *ev) {
 			printf ("\"ppid\":%d,", ev->ppid);
 		}
 		if (ev->proc && *ev->proc) {
+			char *proc = fmu_jsonfilter (ev->proc);
 			printf ("\"proc\":\"%s\",", ev->proc);
+			free (proc);
 		}
 		if (ev->newfile && *ev->newfile) {
-			printf ("\"newfile\":\"%s\",", ev->newfile);
+			char *filename = fmu_jsonfilter (ev->newfile);
+			printf ("\"newfile\":\"%s\",", filename);
+			free (filename);
 		}
 		printf ("\"type\":\"%s\"}", fm_typestr (ev->type));
 	} else {
diff --git a/util.c b/util.c
index e3876be..ddac5a7 100644
--- a/util.c
+++ b/util.c
@@ -105,7 +105,7 @@ const char *fm_colorstr(int type) {
 	return (type >= 0 && type < FSE_MAX_EVENTS)? colors[type]: "";
 }
 
-const char *getProcName(int pid, int *ppid) {
+const char *get_proc_name(int pid, int *ppid) {
 	static char path[PATH_MAX] = {0};
 #if __APPLE__
 	struct kinfo_proc * kinfo = (struct kinfo_proc*)&path;
@@ -193,3 +193,22 @@ bool copy_file(const char *src, const char *dst) {
 	(void) close (fd_dst);
 	return true;
 }
+
+static bool isPrintable(const char ch) {
+	if (ch == '"' || ch == '\\') {
+		return false;
+	}
+	return IS_PRINTABLE (ch);
+}
+
+char *fmu_jsonfilter(const char *s) {
+	char *r, *R = strdup (s);
+	for (r = R; *r; ) {
+		if (isPrintable (*r)) {
+			r++;
+		} else {
+			memmove (r, r + 1, strlen (r) + 1);
+		}
+	}
+	return R;
+}
diff --git a/util.h b/util.h
index 68fefdd..c276d17 100644
--- a/util.h
+++ b/util.h
@@ -3,11 +3,14 @@
 
 #include <stdbool.h>
 
+#define IS_PRINTABLE(x) (x>=' ' && x<='~')
+
+char *fmu_jsonfilter(const char *s);
 const char *fm_argstr(int type);
 const char *fm_typestr(int type);
 const char *fm_colorstr(int type);
 void hexdump(const uint8_t *buf, unsigned int len, int w);
-const char * getProcName(int pid, int *ppid);
+const char * get_proc_name(int pid, int *ppid);
 bool is_directory (const char *str);
 bool copy_file(const char *src, const char *dst);
 
@@ -42,4 +45,5 @@ bool copy_file(const char *src, const char *dst);
 #define Color_BCYAN     "\x1b[1;36m"
 #define Color_BBLUE     "\x1b[1;34m"
 #define Color_BGRAY     "\x1b[1;38m"
+
 #endif